I have sessions enabled in Django to use Django's authentication framework.
From a html page served by Django, and after authenticating as a user with sufficient permissions, I'm trying to send a PATCH request via JQuery's ajax() function, and I'm getting HTTP 403 errors with the response detail CSRF Failed: CSRF token missing or incorrect.
What I've done so far:
I'm including the correct csrf token in the X-CSRF-TOKEN header field.
I've set SESSION_COOKIE_HTTPONLY = False.
The cookie sent in the ajax request includes the sessionid. If I get rid of this sessionid, the request succeeds.To do so, I either delete the session cookies in the browser or edit the PATCH request in the browser's developer tools and resend it with the sessionid deleted from the Cookie header field. Obviously I need to re-login as soon as I refresh the page, but in the meantime, I can PATCH to my heart's content.
So far I couldn't find out why the presence of the sessionid cookie makes Django deny the request.
Related
In Postman Or Jmeter, I want to call a POST API for 100 users in my collection, but after each user login, csrftoken is added to the cookie with the session, but the POST API fails when the cookie contains a csrftoken.
so how to delete the csrftoken from the cookie while maintaining the session ?
Use this as test-script in the postman request. (Note that you have to whitelist your domain in the cookie manager window if you run the collection from postman)
const cookieJar = pm.cookies.jar()
cookieJar.unset("domain.com", "csrftoken", function(error){
})
Refer documentation for more details
You don't need to remove this CSRF token cookie, you need to send correct one.
Not knowing the details of your application it is hard to say what exactly needs to be done, i.e. where the token comes from. If it is being sent by your application in the Set-Cookie header in JMeter it will be enough to add HTTP Cookie Manager
If it comes in the different header or in the response body - you will need to extract it from the previous response using a suitable JMeter Post-Processor and manually add the needed cookie in the HTTP Cookie Manager.
More information: How to Load Test CSRF-Protected Web Sites
I am facing issue while getting the cookie from subsequent request.
I have loginFilter where I am setting the cookie in response like below.
httpResponse.addCookie(new Cookie("TOKEN", "ABCXYSSSS"));
I can see both the cookies i.e JSESSIONID and TOKEN are avaiable in browser.
And when user access new request then I am getting only JSESSIONID in request, not getting TOKEN cookie in request
To get the cookie from repsonse
httpRequest.getCookies();
Could anybody provide me the input on this.
I am using polymer to send ajax requests to my Drupal services api.
I send a POST to login and then a POST to create a node. When I login I am given a token which I store and pass to the next request.
I am monitoring the the requests and responses with Charles, the token is being sent, the cookie is being set and passed on the 2nd POST but I get an "Unauthorized : CSRF validation failed" response.
When I send the request with Postman It works like a dream but for some reason it doesn't validate when sent with my app.
I have checked the token being set matches the one being sent and the only difference I've noticed is that when it's being sent again there is a prefix of ga_; something to do with google analytics?
The expiry of the token is a month away the token matches what is returned at login and is being sent correctly. The header accepts X-CSRF-Token in the Access-Control-Allow-Headers.
My CORS module code is:
api/*|<mirror>|GET, POST, PUT, OPTIONS|Authorization, Origin, Content-Type, X-CSRF-Token|true
If any body has a similar issue, mine was caused by a couple of things, running Drupal and my app in the same browser causing all kinds or cookie conflicts and when passing parameters to my function that computes my request, if there were any parameters that were not used it breaks.
Hope this helps someone.
As I know Same-origin policy forces an Ajax request to be issued only to the domain the script was loaded from.My application does not make any cross domain ajax request. So are all my ajax requests safe from CSRF? or Do I need to use some token for same origin Ajax requests as well?
CSRF is also useful in AJAX request , anyone can access AJAX domain path from other way e.g CURL, so better to add CSRF token to prevent access, it would also good in AJAX request even cross origin request blocked
Can an AJAX response set a cookie? If not, what is my alternative solution? Should I set it with Javascript or something similar?
According to the w3 spec section 4.6.3 for XMLHttpRequest a user agent should honor the Set-Cookie header. So the answer is yes you should be able to.
Quotation:
If the user agent supports HTTP State Management it should persist,
discard and send cookies (as received in the Set-Cookie response
header, and sent in the Cookie header) as applicable.
Yes, you can set cookie in the AJAX request in the server-side code just as you'd do for a normal request since the server cannot differentiate between a normal request or an AJAX request.
AJAX requests are just a special way of requesting to server, the server will need to respond back as in any HTTP request. In the response of the request you can add cookies.
For the record, be advised that all of the above is (still) true only if the AJAX call is made on the same domain. If you're looking into setting cookies on another domain using AJAX, you're opening a totally different can of worms. Reading cross-domain cookies does work, however (or at least the server serves them; whether your client's UA allows your code to access them is, again, a different topic; as of 2014 they do).
Also check that your server isn't setting secure cookies on a non http request. Just found out that my ajax request was getting a php session with "secure" set. Because I was not on https it was not sending back the session cookie and my session was getting reset on each ajax request.